I have an Apache server that hosts multiple sites, one of them use CGI, one of them does not. While security scanning this non-CGI site was flagged in the tool for security review for a CGI page.
I am trying to block that page in Apache using the following methods, but it does not seem to work either way:
Testing in Apache site vhost:
<Location />
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/cgi-bin/serve-boxcgi$ [NC]
RewriteRule ^.*$ - [F,L]
</Location>
Testing in .htaccess for this site:
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/cgi-bin/serve-boxcgi$ [NC]
RewriteRule ^.*$ - [F,L]
</IfModule>
The site is PHP based. It does use PHP-fpm/fast-CGI configurations.
Please advise what I may be doing wrong here.